Skip to content
Founder-led WordPress incident response and care Request an assessment
3zerodigital Request a Website Assessment

Plugin security history

Page Builder: Pagelayer – Drag and Drop website builder Vulnerability History & Security Timeline

The Wordfence Intelligence dataset currently contains 30 vulnerability records associated with Page Builder: Pagelayer – Drag and Drop website builder, published between 2020 and 2026.

Dataset last synchronized: 2026-08-03 00:31:25 UTC

At a glance

Security Snapshot

30Total records
0Critical
3High
27Medium
0Low
0Informational
30Patched records
0Currently marked unpatched
2020-05-28First disclosure
2026-06-12Latest disclosure
29 of 30CVE coverage

Year-by-Year Timeline

YearRecordsRelative volume
202044 records
202355 records
202499 records
202577 records
202655 records

Severity Breakdown

SeverityRecordsShare
High310%
Medium2790%

Vulnerability-Type Breakdown

Cross-Site Scripting

19 records63.3%

First: 2020. Latest: 2026.

Missing Authorization

6 records20%

First: 2023. Latest: 2026.

CSRF

2 records6.7%

First: 2020. Latest: 2025.

Privilege Escalation

1 record3.3%

First: 2025. Latest: 2025.

Information Disclosure

1 record3.3%

First: 2026. Latest: 2026.

Other

1 record3.3%

First: 2026. Latest: 2026.

Patch Status

Patched
30
Currently marked unpatched
0
Unknown status
0

Patch status reflects the latest successfully synchronized source dataset and must be checked against the installed version.

Latest Known Patched Versions

  • 2.1.0
  • 2.0.9
  • 2.0.8
  • 2.0.6
  • 2.0.1
  • 2.0.0
  • 1.9.9
  • 1.9.5
  • 1.9.0
  • 1.8.8
  • 1.8.2
  • 1.8.5
  • 1.8.4
  • 1.8.3
  • 1.8.0
  • 1.7.9
  • 1.8.1
  • 1.7.8
  • 1.7.7
  • 1.3.5
  • 1.1.2

Affected-Version History

Ranges are deduplicated by source range record and shown with the associated disclosure and known patched versions.

Affected rangeVulnerabilityPublishedPatched versionSeverity
[*, 1.7.7)PageLayer <= 1.7.6 - Authenticated (Contributor+) Stored Cross-Site ScriptingSeptember 13, 20231.7.7Medium
[*, 1.3.5)Page Builder: Pagelayer – Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via Color SettingsDecember 10, 20201.3.5Medium
[*, 1.3.5)Page Builder: Pagelayer – Drag and Drop website builder < 1.3.5 - Reflected Cross-Site Scripting via font-sizeDecember 10, 20201.3.5Medium
[*, 1.1.2)Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site ScriptingMay 28, 20201.1.2High
[*, 1.1.2)Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site ScriptingMay 28, 20201.1.2High

Selected source records

Latest Records

MediumCVE-2026-2470

Pagelayer <= 2.0.9 - Incorrect Authorization to Authenticated (Contributor+) Mail Relay Configuration via 'contacts'

Published: June 12, 2026

Affected versions
*-2.0.9
Patched versions
2.1.0
Original Wordfence record
MediumCVE-2026-3297

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

Published: June 12, 2026

Affected versions
*-2.0.9
Patched versions
2.1.0
Original Wordfence record
MediumCVE-2026-2509

Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes

Published: April 7, 2026

Affected versions
*-2.0.8
Patched versions
2.0.9
Original Wordfence record
MediumCVE-2026-2442

Pagelayer <= 2.0.7 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via 'email'

Published: March 27, 2026

Affected versions
*-2.0.7
Patched versions
2.0.8
Original Wordfence record
MediumCVE-2026-39469

PageLayer <= 2.0.8 - Authenticated (Contributor+) Information Exposure

Published: March 12, 2026

Affected versions
*-2.0.8
Patched versions
2.0.9
Original Wordfence record
MediumCVE-2025-12366

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.5 - Authenticated (Author+) Insecure Direct Object Reference

Published: November 12, 2025

Affected versions
*-2.0.5
Patched versions
2.0.6
Original Wordfence record
MediumCVE-2025-4223

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Reflected Cross-Site Scripting via login_url Parameter

Published: May 23, 2025

Affected versions
*-2.0.0
Patched versions
2.0.1
Original Wordfence record
MediumCVE-2024-13427

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link

Published: May 23, 2025

Affected versions
*-2.0.0
Patched versions
2.0.1
Original Wordfence record

Highest-Severity Records

HighCVE-2020-35944

Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Cross-Site Request Forgery to Cross-Site Scripting

Published: May 28, 2020

Affected versions
[*, 1.1.2)
Patched versions
1.1.2
Original Wordfence record
HighCVE-2020-35947

Page Builder: Pagelayer – Drag and Drop website builder <= 1.1.1 - Missing Authorization to Cross-Site Scripting

Published: May 28, 2020

Affected versions
[*, 1.1.2)
Patched versions
1.1.2
Original Wordfence record
HighCVE-2023-4687

Page Builder: Pagelayer – Drag and Drop website builder <= 1.7.6 - Missing Authorization to Stored Cross-Site Scripting

Published: September 25, 2023

Affected versions
*-1.7.6
Patched versions
1.7.7
Original Wordfence record
MediumCVE-2025-24573

PageLayer <= 1.9.4 - Authenticated (Contributor+) Stored Cross-Site Scripting

Published: January 24, 2025

Affected versions
*-1.9.4
Patched versions
1.9.5
Original Wordfence record
MediumCVE-2024-13427

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Link

Published: May 23, 2025

Affected versions
*-2.0.0
Patched versions
2.0.1
Original Wordfence record
MediumCVE-2026-2509

Page Builder: Pagelayer <= 2.0.8 - Authenticated (Contributor+) Stored Cross-Site Scripting via Button Widget Custom Attributes

Published: April 7, 2026

Affected versions
*-2.0.8
Patched versions
2.0.9
Original Wordfence record
MediumCVE-2024-2127

Page Builder: Pagelayer – Drag and Drop website builder <= 1.8.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Custom Attributes

Published: March 7, 2024

Affected versions
*-1.8.3
Patched versions
1.8.4
Original Wordfence record
MediumCVE-2026-3297

Page Builder: Pagelayer – Drag and Drop website builder <= 2.0.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via Anchor Block

Published: June 12, 2026

Affected versions
*-2.0.9
Patched versions
2.1.0
Original Wordfence record

View all associated vulnerabilities

Need help reviewing an exposed WordPress website?

Running an affected version does not prove that a website was compromised. Suspicious redirects, unknown administrators, injected content, unexpected files or recurring malware may require a manual investigation.

WordPress Malware RemovalWordPress Security MaintenanceContact 3Zero Digital

Vulnerability data: Wordfence Intelligence. Analysis and practical guidance: 3Zero Digital.

Data Source, Attribution and Methodology

This page aggregates active Production Feed records. Counts are not software-quality rankings, and an affected version does not prove exploitation or infection. Read the full methodology.

Return to the Security History Directory